Paper trail: Personal data found blowing in wind

January 29, 2010

When Elida Cruz worked in the banking industry, she assured clients that their personal information would remain confidential.

So, imagine her horror when she learned that much of her own information, including her Social Security number, birth date, phone number and job history, had become astonishingly public, floating down a Des Plaines street in a cloud of half-shredded paperwork.

After being tipped to the airborne paper trail, the Tribune contacted some of the people and companies listed on the documents.

None of them knew how the papers could have ended up in the street.

"I am pretty much disgusted with this," said Cruz, 47, of Chicago, who was notified that at least 17 documents with her Social Security number (the apparent remnants of an old job application) had been retrieved. "All of that is sensitive information. You would think your stuff is secure."

Privacy experts say the loss of confidential paperwork illustrates that even in an electronic age, stray documents remain a danger.

"It's a lot more frequent than people would suspect," said Paul Stephens, director of policy and advocacy for the Privacy Rights Clearinghouse in San Diego. "Most of the time it's just not discovered."

His group, which pushes for tighter privacy laws, tracks breaches of sensitive information. Though computer hackers are behind most such data loss, careless document disposal still causes problems. Since 2006, the clearinghouse has noted 33 cases of legal, medical and financial paperwork discovered in trash bins.

Losing track of sensitive documents can have serious consequences.

Washington, D.C., attorney Christopher Wolf, founder of the Future of Privacy Forum and a partner at Hogan and Hartson, said state and federal laws on data security have gotten tougher in recent years. Companies that lose records often must announce it publicly, he said -- a public relations nightmare.

"These laws certainly have spurred compliance, and every major corporation now understands they have a data security obligation," he said. "Companies know they can't put sensitive records on the curbside or throw them in the Dumpster. It's not to say that never happens, but it's rarer."